I installed graylog via the ansible-playbook from here. https://galaxy.ansible.com/Graylog2/graylog-ansible-role
It is the default configuration from the playbook.
Everything went fine, until I tried opening graylog in any webbrowser.
I took a look at the server logs (/var/log/graylog-server/server.log) which told me the following.
"Incorrect HTTP method for uri [/graylog_*/_aliases] and method [GET], allowed: [PUT]"
at org.graylog2.indexer.cluster.jest.JestUtils.specificException(JestUtils.java:95) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:57) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:62) ~[graylog.jar:?]
at org.graylog2.indexer.indices.Indices.getIndexNamesAndAliases(Indices.java:308) ~[graylog.jar:?]
at org.graylog2.indexer.MongoIndexSet.getNewestIndexNumber(MongoIndexSet.java:151) ~[graylog.jar:?]
at org.graylog2.indexer.MongoIndexSet.getNewestIndex(MongoIndexSet.java:146) ~[graylog.jar:?]
at org.graylog2.indexer.MongoIndexSet.setUp(MongoIndexSet.java:252) ~[graylog.jar:?]
at org.graylog2.periodical.IndexRotationThread.checkAndRepair(IndexRotationThread.java:138) ~[graylog.jar:?]
at org.graylog2.periodical.IndexRotationThread.lambda$doRun$0(IndexRotationThread.java:76) ~[graylog.jar:?]
at java.lang.Iterable.forEach(Iterable.java:75) [?:1.8.0_181]
at org.graylog2.periodical.IndexRotationThread.doRun(IndexRotationThread.java:73) [graylog.jar:?]
at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:77) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_181]
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_181]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_181]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_181]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_181]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_181]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_181]
2018-09-20T11:24:37.554+02:00 INFO [MongoIndexSet] Did not find a deflector alias. Setting one up now.
2018-09-20T11:24:37.555+02:00 ERROR [IndexRotationThread] Couldn't point deflector to a new index
org.graylog2.indexer.ElasticsearchException: Couldn't collect aliases for index pattern graylog_*
The elasticsearch log doesn’t really tell anything.
Without any information that would help us to identify the issue everyone can only guess.
What did your configuration looks like (Graylog and Elasticsearch)? Did you run everything on one host? What are the available ressources? How did you call the playbook? Did you try to access the Graylog UI from the same system or is this remote?
I used the HowTo to install graylog via ansible. I did not change any configuration afterwards. I justed changed the playbook to skip the XPack installation. I called the playbook via ansible-playbook linux/setup_graylog.yml -l graylog --ask-become-pass
The playbook looks like this:
- hosts: "{{ hosts | default('all')}}"
become: True
vars:
# Graylog is compatible with elasticsearch 5.x since version 2.3.0, so ensure to use the right combination for your installation
# Also use the right branch of the Elasticsearch Ansible role, master supports 5.x
es_api_basic_auth_username: 'admin'
es_api_basic_auth_password: 'admin'
es_major_version: "5.x"
es_instance_name: 'graylog'
es_scripts: False
es_templates: False
es_version_lock: False
es_heap_size: 1g
es_config: {
node.name: "graylog",
cluster.name: "graylog",
http.port: 9200,
transport.tcp.port: 9300,
network.host: 0.0.0.0,
node.data: true,
node.master: true,
}
# Elasticsearch role already installed Java
graylog_java_install: False
graylog_install_mongodb: True
# For Vagrant installations make sure port 9000 is forwarded
graylog_web_endpoint_uri: 'http://localhost:9000/api/'
# For other setups, use the external IP of the Graylog server
# graylog_web_endpoint_uri: 'http://{{ ansible_host }}:9000/api/'
nginx_sites:
graylog:
- listen 80
- server_name graylog
- location / {
proxy_pass http://localhost:9000/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass_request_headers on;
proxy_connect_timeout 150;
proxy_send_timeout 100;
proxy_read_timeout 100;
proxy_buffers 4 32k;
client_max_body_size 8m;
client_body_buffer_size 128k; }
roles:
- role: 'Graylog2.graylog-ansible-role'
tags: graylog
and you have bound your Interface to localhost of the server where it runs …
web_endpoint_uri = http://localhost:9000/api/
That should be a hostname or IP of the system where Graylog is running.
In addition, your Elasticsearch is running listening on all interfaces (which might be a security issue) but you use localhost in the Graylog configuration.
